Zoho published advisories on November 12 for eight critical ManageEngine vulnerabilities across M365 Manager Plus, ServiceDesk Plus and DDI Central, with the top score of CVSS 9.9 going to a privilege escalation in M365 Manager Plus. No exploitation has been reported, and none of the flaws appears in the CISA Known Exploited Vulnerabilities catalog.
CVE-2026-12591 in M365 Manager Plus Scores 9.9
CVE-2026-12591 is caused by weak permission checks in the delegated administration feature of M365 Manager Plus. A technician can use the weakness to escalate privileges, and the escalation can potentially lead to remote code execution. Zoho fixed the flaw in build 4818.
The delegated-administration model is meant to give help-desk technicians limited rights over Microsoft 365 tenants. A flaw that lets a technician exceed those rights means a single phished technician login could lead to command execution on the server.
CVE-2026-12507 in ServiceDesk Plus Reports
CVE-2026-12507 scores 9.1 and affects the Reports module of ServiceDesk Plus. A user holding the Create Query Reports permission can run commands on the server. As with the M365 Manager Plus bug, the weakness turns a limited role into server-level control.
Six DDI Central Flaws and the One Unauthenticated Bug
DDI Central accounts for six of the eight CVEs. CVE-2026-19422, rated 9.1, is the only unauthenticated flaw in the set. It sits in the Windows DNS and DHCP agent synchronization APIs and allows an attacker to impersonate onboarded Windows servers and make DNS and DHCP changes.
PowerShell Injection Through DNS Records
CVE-2026-19421 and CVE-2026-75869 allow PowerShell injection. An attacker can deliver the injection through crafted TXT records or DNS suffix values, which makes data that looks routine in a DNS zone a carrier for commands. The remaining DDI Central bugs let non-admin users change DHCP options or delete DNS zones.
Fixes and Network Restrictions Zoho Recommends
Zoho advises upgrading to the fixed builds, reviewing technician roles, and restricting network access to the DDI Central agent synchronization APIs. The company named no workaround for the flaws.
The affected products sit at the center of IT operations. DNS, DHCP, help-desk and Microsoft 365 administration tools hold broad privileges by design, and attackers who compromise them gain a staging point for further movement. That is the reason the advisory’s emphasis on role review matters: most of the eight flaws require some level of authenticated access, so the quality of a technician’s account protection decides how much those bugs are worth to an attacker.
The advisory is separate from the November 6 Zoho release, which covered Key Manager Plus, Log360 and EventLog Analyzer. Administrators who patched those products still need to act on these. Only CVE-2026-19422 can be reached without credentials, so DDI Central instances with exposed agent synchronization APIs deserve attention first.
Role Review as the Practical Control
Zoho’s advice to review technician roles speaks to the weakest link in several of these flaws. CVE-2026-12591 and CVE-2026-12507 both depend on someone already holding a legitimate login, whether a delegated technician in M365 Manager Plus or a user with Create Query Reports permission in ServiceDesk Plus. That makes account hygiene, including who holds such roles and how those logins are protected, as important as installing the build.
DDI Central Agent Synchronization Exposure
The only unauthenticated bug, CVE-2026-19422, lets an attacker impersonate onboarded Windows servers and change DNS and DHCP settings. Because DNS and DHCP control how every device on a network finds its way, silent changes there could redirect traffic or disrupt service. Zoho’s instruction to restrict network access to the agent synchronization APIs is the control aimed at this risk, since the company named no workaround for the underlying flaw.
